# NoMercy MediaServer Dockerfile - Intel Quick Sync Video Support
# Includes Intel media drivers and VAAPI libraries for hardware acceleration
#
# FFmpeg is downloaded by the MediaServer at runtime with QSV support.
# This image provides the necessary Intel drivers and libraries.

# =============================================================================
# Stage 1: Build
# =============================================================================
FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
WORKDIR /src

# Copy source and restore dependencies
COPY NoMercy.Server.sln ./
COPY src/ src/
COPY assets/ assets/
RUN dotnet restore src/NoMercy.Service/NoMercy.Service.csproj

# Build and publish
RUN dotnet publish src/NoMercy.Service/NoMercy.Service.csproj \
    -c Release \
    -o /app/publish \
    --no-restore \
    -p:PublishSingleFile=false \
    -p:DebugType=None \
    -p:DebugSymbols=false

# =============================================================================
# Stage 2: Runtime with Intel QSV libraries
# =============================================================================
FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtime
WORKDIR /app

# Install Intel media drivers and VAAPI libraries
RUN apt-get update && apt-get install -y --no-install-recommends \
    # Intel Media Driver (iHD) for VAAPI - supports QSV
    intel-media-va-driver-non-free \
    # Intel OpenCL runtime (for some filters)
    intel-opencl-icd \
    # Intel Media SDK / oneVPL runtime
    libmfx1 \
    libvpl2 \
    # VAAPI libraries
    libva2 \
    libva-drm2 \
    libva-x11-2 \
    # DRM libraries
    libdrm2 \
    libdrm-intel1 \
    # Media info
    mediainfo \
    curl \
    sqlite3 \
    htop \
    nvtop \
    # Required for outbound HTTPS (Keycloak, TMDB, API key fetch) — without
    # this .NET has no trusted root store and every TLS handshake fails with
    # AuthenticationException: UntrustedRoot. Present on the base Dockerfile,
    # missing here.
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Create non-root user for security
RUN useradd -m -o -u 1000 nomercy \
    && usermod -aG video,render nomercy

# Create data directories
RUN mkdir -p /data/config /data/cache /data/media /data/log \
    && chown -R nomercy:nomercy /data

# Copy published application
COPY --from=build /app/publish .

# Set ownership
RUN chown -R nomercy:nomercy /app

# Switch to non-root user
USER nomercy

# Environment variables
ENV ASPNETCORE_ENVIRONMENT=Production
ENV DOTNET_RUNNING_IN_CONTAINER=true
ENV HOME=/data
ENV LANG=C.UTF-8
ENV LC_ALL=C.UTF-8
# Intel QSV environment variables
ENV LIBVA_DRIVER_NAME=iHD
ENV LIBVA_DRIVERS_PATH=/usr/lib/x86_64-linux-gnu/dri

# Expose port
EXPOSE 7626

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
    CMD curl -fsk https://127.0.0.1:7626/health || curl -fs http://127.0.0.1:7626/health || exit 1

# Entry point
ENTRYPOINT ["dotnet", "NoMercyMediaServer.dll"]
CMD ["--internal-port", "7626"]